@oxyhq/core 5.5.0 → 6.0.0

package/dist/types/mixins/{OxyServices.redirect.d.ts → OxyServices.authorizedApps.d.ts}

@@ -1,48 +1,52 @@
-import type { OxyServicesBase } from '../OxyServices.base';
-import type { SessionLoginResponse } from '../models/session';
-export interface RedirectAuthOptions {
-    redirectUri?: string;
-    mode?: 'login' | 'signup';
-    preserveUrl?: boolean;
-}
 /**
- * Redirect-based authentication without bearer tokens in URLs.
+ * Authorized-apps mixin — the "Connected apps" management surface that survived
+ * the FedCM removal.
  *
- * The redirect fallback now uses the same central SSO code-return contract as
- * cold boot: the RP stores CSRF/destination state in sessionStorage, navigates
- * to the central IdP, receives only an opaque one-time code in the URL fragment,
- * and the provider's `sso-return` step exchanges that code for the real session.
+ * These two methods read/revoke the user's LEGACY FedCM authorization grants
+ * (`GET`/`DELETE /fedcm/me/authorized-apps`). They are the last live consumers
+ * of that endpoint (services' `ConnectedAppsScreen` via `useAccountQueries` /
+ * `useAccountMutations`) and stay until the AppGrant migration retires the
+ * FedCM grant store. All FedCM SIGN-IN machinery was deleted with
+ * `OxyServices.fedcm.ts`; this is management-only, so it has no dependency on
+ * the credential/nonce pipeline.
+ */
+import type { OxyServicesBase } from '../OxyServices.base';
+/**
+ * Public summary of an RP application the user has authorized — mirrors the
+ * `AuthorizedAppSummary` shape returned by `GET /fedcm/me/authorized-apps`.
  */
-export declare function OxyServicesRedirectAuthMixin<T extends typeof OxyServicesBase>(Base: T): {
+export interface AuthorizedApp {
+    /** Normalised RP origin. */
+    origin: string;
+    /** Friendly display name. */
+    name: string;
+    /** Optional human-readable description. */
+    description?: string;
+    /** ISO-8601 timestamp of when the user first authorized this RP. */
+    firstGrantedAt: string;
+    /** ISO-8601 timestamp of the most recent FedCM exchange for this user+RP. */
+    lastUsedAt: string;
+}
+export declare function OxyServicesAuthorizedAppsMixin<T extends typeof OxyServicesBase>(Base: T): {
     new (...args: any[]): {
         /**
-         * Start a full-page redirect through the central SSO flow.
-         *
-         * No access token, refresh token, or session id is ever put in the URL or
-         * localStorage. The caller's provider must run `consumeSsoReturn` on startup
-         * to complete the code exchange and commit the session.
+         * List the authenticated user's authorized RP apps — the intersection of the
+         * user's FedCM grants and the currently-approved RP catalog. Powers the
+         * "Connected apps" management UI. Requires a real user session.
          */
-        signInWithRedirect(options?: RedirectAuthOptions): void;
-        signUpWithRedirect(options?: RedirectAuthOptions): void;
+        listAuthorizedApps(): Promise<AuthorizedApp[]>;
         /**
-         * Legacy token-query callbacks are intentionally rejected. Modern providers
-         * complete redirect auth through `consumeSsoReturn`, which accepts only
-         * `#oxy_sso=ok&code=...`.
+         * Revoke the authenticated user's authorization for a specific RP origin.
+         * The corresponding cache entry is invalidated so a subsequent
+         * `listAuthorizedApps()` sees fresh data.
          */
-        handleAuthCallback(): SessionLoginResponse | null;
-        restoreSession(): boolean;
-        clearStoredSession(): void;
-        getStoredSessionId(): string | null;
-        generateState(): string;
-        generateNonce(): string;
-        cleanAuthCallbackUrl(url: URL): void;
+        revokeAuthorizedApp(origin: string): Promise<void>;
         httpService: import("../HttpService").HttpService;
         cloudURL: string;
         config: import("../OxyServices.base").OxyConfig;
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -71,7 +75,6 @@ export declare function OxyServicesRedirectAuthMixin<T extends typeof OxyService
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
@@ -89,4 +92,3 @@ export declare function OxyServicesRedirectAuthMixin<T extends typeof OxyService
         }>;
     };
 } & T;
-export { OxyServicesRedirectAuthMixin as RedirectAuthMixin };

package/dist/types/mixins/OxyServices.civic.d.ts

@@ -463,7 +463,6 @@ export declare function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -492,7 +491,6 @@ export declare function OxyServicesCivicMixin<T extends typeof OxyServicesBase>(
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.connectedApps.d.ts

@@ -118,7 +118,6 @@ export declare function OxyServicesConnectedAppsMixin<T extends typeof OxyServic
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -147,7 +146,6 @@ export declare function OxyServicesConnectedAppsMixin<T extends typeof OxyServic
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.contacts.d.ts

@@ -53,7 +53,6 @@ export declare function OxyServicesContactsMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -82,7 +81,6 @@ export declare function OxyServicesContactsMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.deviceBoot.d.ts

@@ -0,0 +1,110 @@
+/**
+ * Device-first bootstrap mixin (auth centralization, wave 1).
+ *
+ * The client half of the new device-first session bootstrap: the four network
+ * calls the cold boot (`coldBootV2`) and the unified refresh handler
+ * (`refresh.ts`) make, plus the URL builder for the cross-apex bootstrap hop.
+ * Every response is validated against the `@oxyhq/contracts` `deviceBoot`
+ * schemas via `safeParseContract`, so producer (oxy-api) and consumer cannot
+ * drift — an unexpected shape throws here rather than silently corrupting the
+ * persisted store.
+ *
+ * These methods are ADDITIVE and carry NO persistence or token-planting side
+ * effects of their own (except the bearer-authenticated calls that naturally
+ * flow through `HttpService`). The cold boot / refresh handler own persistence
+ * and `setTokens`, so the same network primitive can be reused from either
+ * without double-planting.
+ */
+import { type AuthTokenBundle, type TokenRefreshResponse, type WebSessionResult } from '@oxyhq/contracts';
+import type { OxyServicesBase } from '../OxyServices.base';
+export declare function OxyServicesDeviceBootMixin<T extends typeof OxyServicesBase>(Base: T): {
+    new (...args: any[]): {
+        /**
+         * Exchange a single-use boot `code` (from the `#oxy_boot` return fragment)
+         * for a token bundle. Origin-bound + GETDEL-burned server-side.
+         *
+         * @throws if the response does not match {@link authTokenBundleSchema}.
+         */
+        exchangeBootCode(code: string): Promise<AuthTokenBundle>;
+        /**
+         * Same-site fast path (`*.oxy.so` apps). Reads the first-party `oxy_device`
+         * cookie via a credentialed same-origin fetch and either resolves a full
+         * session bundle or reports the device is known-but-signed-out. Never
+         * redirects.
+         *
+         * @throws if the response matches neither arm of {@link webSessionResultSchema}.
+         */
+        requestWebSession(): Promise<WebSessionResult>;
+        /**
+         * Rotate the persisted refresh-token family (web + native, one call). The
+         * caller (refresh handler / cold boot) plants + persists the rotated pair.
+         *
+         * @throws if the response does not match {@link tokenRefreshResponseSchema}.
+         */
+        refreshWithToken(refreshToken: string): Promise<TokenRefreshResponse>;
+        /**
+         * Issue (or rotate) the native channel's opaque device token. Bearer-gated —
+         * the server derives the deviceId from the JWT. Native apps mirror the
+         * returned token into the shared keychain via
+         * `KeyManager.setSharedDeviceToken`.
+         *
+         * @throws if the response does not match {@link deviceTokenIssueResponseSchema}.
+         */
+        issueNativeDeviceToken(): Promise<string>;
+        /**
+         * Build the top-level `GET /auth/device/bootstrap` URL for the cross-apex
+         * hop. The server validates `return_to` against the trusted-origin lane and
+         * echoes `state` back in the return fragment for CSRF verification.
+         */
+        buildBootstrapUrl(returnTo: string, state: string): string;
+        httpService: import("../HttpService").HttpService;
+        cloudURL: string;
+        config: import("../OxyServices.base").OxyConfig;
+        __resetTokensForTests(): void;
+        makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
+        getBaseURL(): string;
+        getClient(): import("../HttpService").HttpService;
+        createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
+        getMetrics(): {
+            totalRequests: number;
+            successfulRequests: number;
+            failedRequests: number;
+            cacheHits: number;
+            cacheMisses: number;
+            averageResponseTime: number;
+        };
+        clearCache(): void;
+        clearCacheEntry(key: string): void;
+        clearCacheByPrefix(prefix: string): number;
+        getCacheStats(): {
+            size: number;
+            hits: number;
+            misses: number;
+            hitRate: number;
+        };
+        getCloudURL(): string;
+        setTokens(accessToken: string): void;
+        clearTokens(): void;
+        onTokensChanged(listener: (accessToken: string | null) => void): () => void;
+        _cachedUserId: string | null | undefined;
+        _cachedAccessToken: string | null;
+        getCurrentUserId(): string | null;
+        hasValidToken(): boolean;
+        getAccessToken(): string | null;
+        getAccessTokenExpiry(): number | null;
+        waitForAuth(timeoutMs?: number): Promise<boolean>;
+        withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {
+            maxRetries?: number;
+            retryDelay?: number;
+            authTimeoutMs?: number;
+        }): Promise<T_1>;
+        validate(): Promise<boolean>;
+        handleError(error: unknown): Error;
+        healthCheck(): Promise<{
+            status: string;
+            users?: number;
+            timestamp?: string;
+            [key: string]: any;
+        }>;
+    };
+} & T;

package/dist/types/mixins/OxyServices.devices.d.ts

@@ -55,7 +55,6 @@ export declare function OxyServicesDevicesMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -84,7 +83,6 @@ export declare function OxyServicesDevicesMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.features.d.ts

@@ -203,7 +203,6 @@ export declare function OxyServicesFeaturesMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -232,7 +231,6 @@ export declare function OxyServicesFeaturesMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.identity.d.ts

@@ -205,7 +205,6 @@ export declare function OxyServicesIdentityMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -234,7 +233,6 @@ export declare function OxyServicesIdentityMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.language.d.ts

@@ -40,7 +40,6 @@ export declare function OxyServicesLanguageMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -69,7 +68,6 @@ export declare function OxyServicesLanguageMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.links.d.ts

@@ -57,7 +57,6 @@ export declare function OxyServicesLinksMixin<T extends typeof OxyServicesBase>(
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -86,7 +85,6 @@ export declare function OxyServicesLinksMixin<T extends typeof OxyServicesBase>(
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.location.d.ts

@@ -23,7 +23,6 @@ export declare function OxyServicesLocationMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -52,7 +51,6 @@ export declare function OxyServicesLocationMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.nodes.d.ts

@@ -151,7 +151,6 @@ export declare function OxyServicesNodesMixin<T extends typeof OxyServicesBase>(
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -180,7 +179,6 @@ export declare function OxyServicesNodesMixin<T extends typeof OxyServicesBase>(
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.payment.d.ts

@@ -70,7 +70,6 @@ export declare function OxyServicesPaymentMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -99,7 +98,6 @@ export declare function OxyServicesPaymentMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.privacy.d.ts

@@ -99,7 +99,6 @@ export declare function OxyServicesPrivacyMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -128,7 +127,6 @@ export declare function OxyServicesPrivacyMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.reputation.d.ts

@@ -388,7 +388,6 @@ export declare function OxyServicesReputationMixin<T extends typeof OxyServicesB
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -417,7 +416,6 @@ export declare function OxyServicesReputationMixin<T extends typeof OxyServicesB
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.security.d.ts

@@ -37,7 +37,6 @@ export declare function OxyServicesSecurityMixin<T extends typeof OxyServicesBas
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -66,7 +65,6 @@ export declare function OxyServicesSecurityMixin<T extends typeof OxyServicesBas
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.topics.d.ts

@@ -63,7 +63,6 @@ export declare function OxyServicesTopicsMixin<T extends typeof OxyServicesBase>
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -92,7 +91,6 @@ export declare function OxyServicesTopicsMixin<T extends typeof OxyServicesBase>
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.user.d.ts

@@ -413,7 +413,6 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -442,7 +441,6 @@ export declare function OxyServicesUserMixin<T extends typeof OxyServicesBase>(B
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/OxyServices.utility.d.ts

@@ -228,7 +228,6 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
         __resetTokensForTests(): void;
         makeRequest<T_1>(method: "GET" | "POST" | "PUT" | "PATCH" | "DELETE", url: string, data?: any, options?: import("../HttpService").RequestOptions): Promise<T_1>;
         getBaseURL(): string;
-        getSessionBaseUrl(): string;
         getClient(): import("../HttpService").HttpService;
         createLinkedClient(config: import("../OxyServices.base").OxyConfig): import("..").LinkedHttpClient;
         getMetrics(): {
@@ -257,7 +256,6 @@ export declare function OxyServicesUtilityMixin<T extends typeof OxyServicesBase
         getCurrentUserId(): string | null;
         hasValidToken(): boolean;
         getAccessToken(): string | null;
-        establishDeviceRefreshSlot(): Promise<number | null>;
         getAccessTokenExpiry(): number | null;
         waitForAuth(timeoutMs?: number): Promise<boolean>;
         withAuthRetry<T_1>(operation: () => Promise<T_1>, operationName: string, options?: {

package/dist/types/mixins/index.d.ts

@@ -6,10 +6,7 @@
  */
 import { OxyServicesBase } from '../OxyServices.base';
 import { OxyServicesAuthMixin } from './OxyServices.auth';
-import { OxyServicesFedCMMixin } from './OxyServices.fedcm';
-import { OxyServicesSilentAuthMixin } from './OxyServices.silent';
-import { OxyServicesRedirectAuthMixin } from './OxyServices.redirect';
-import { OxyServicesSsoMixin } from './OxyServices.sso';
+import { OxyServicesAuthorizedAppsMixin } from './OxyServices.authorizedApps';
 import { OxyServicesUserMixin } from './OxyServices.user';
 import { OxyServicesIdentityMixin } from './OxyServices.identity';
 import { OxyServicesPrivacyMixin } from './OxyServices.privacy';
@@ -31,6 +28,7 @@ import { OxyServicesAppDataMixin } from './OxyServices.appData';
 import { OxyServicesCivicMixin } from './OxyServices.civic';
 import { OxyServicesNodesMixin } from './OxyServices.nodes';
 import { OxyServicesLinksMixin } from './OxyServices.links';
+import { OxyServicesDeviceBootMixin } from './OxyServices.deviceBoot';
 /**
  * Instance shape of every mixin in the pipeline, intersected. The runtime
  * `composeOxyServices()` produces a class whose instances expose all of
@@ -40,7 +38,7 @@ import { OxyServicesLinksMixin } from './OxyServices.links';
  * If you add a new mixin to `MIXIN_PIPELINE`, add it here too so its methods
  * are visible without a cast.
  */
-type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFedCMMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSilentAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesRedirectAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSsoMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLinksMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
+type AllMixinInstances = InstanceType<ReturnType<typeof OxyServicesAuthMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAuthorizedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUserMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesIdentityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPrivacyMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLanguageMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesPaymentMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesReputationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAssetsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAccountsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesConnectedAppsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLocationMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAnalyticsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDevicesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesSecurityMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesFeaturesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesTopicsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesContactsMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesAppDataMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesCivicMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesNodesMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesLinksMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesDeviceBootMixin<typeof OxyServicesBase>>> & InstanceType<ReturnType<typeof OxyServicesUtilityMixin<typeof OxyServicesBase>>>;
 /**
  * Constructor type for the fully composed mixin pipeline. Each mixin returns
  * a new constructor that augments its input; reducing across the pipeline
@@ -59,10 +57,9 @@ type MixinFunction = (Base: new (...args: unknown[]) => OxyServicesBase) => new
  *
  * Order matters for dependencies:
  * 1. Base auth mixin first (required by all others)
- * 2. Cross-domain auth mixins (FedCM, silent iframe, Redirect)
- * 3. User mixin (requires auth)
- * 4. Feature mixins (can depend on user)
- * 5. Utility mixin last (augments all)
+ * 2. User mixin (requires auth)
+ * 3. Feature mixins (can depend on user)
+ * 4. Utility mixin last (augments all)
  *
  * To add a new mixin: insert it at the appropriate position in this array.
  */

package/dist/types/models/interfaces.d.ts

@@ -2,20 +2,6 @@ import type { UserNameResponse } from '@oxyhq/contracts';
 export interface OxyConfig {
     baseURL: string;
     cloudURL?: string;
-    /**
-     * Base URL the SDK's first-party session/refresh calls target.
-     *
-     * Per the 2026 session architecture (docs/SESSION-ARCHITECTURE.md), every app
-     * keeps its OWN first-party session on its OWN domain. For non-`oxy.so` apps
-     * this is the app's own same-site backend (e.g. `https://api.mention.earth`),
-     * whose session bridge forwards the user's refresh credential to
-     * `api.oxy.so`. For `*.oxy.so` apps this is omitted and falls back to
-     * `baseURL` (`https://api.oxy.so`), so their behavior is unchanged.
-     *
-     * Resolve via {@link OxyServices.getSessionBaseUrl}; when unset it returns
-     * `baseURL`. This is purely additive — no refresh/auth logic reads it yet.
-     */
-    sessionBaseUrl?: string;
     authWebUrl?: string;
     authRedirectUri?: string;
     /**
@@ -110,7 +96,6 @@ export interface User {
     phone?: string;
     address?: string;
     birthday?: string;
-    location?: string;
     website?: string;
     createdAt?: string;
     updatedAt?: string;
@@ -584,55 +569,3 @@ export interface UpdateDeviceNameResponse {
     message: string;
     deviceName: string;
 }
-/**
- * Minimal user shape included in a `RefreshAllAccount` entry. The server
- * projects a small whitelist (`username name avatar email color`) so the
- * client can render the account chooser without an extra `/users/me` round
- * trip per account.
- *
- * `avatar` and `color` are `string | null` because they are stored as nullable
- * fields in the user document.
- */
-export interface RefreshAllAccountUser {
-    id: string;
-    username: string;
-    /**
-     * Structured human name as emitted by `formatUserResponse` (the canonical
-     * {@link UserNameResponse} `{ first?, last?, full? }` subdocument), NOT a bare
-     * string. The server projects `name` verbatim from the user document. The
-     * single source of truth is `@oxyhq/contracts`.
-     */
-    name: UserNameResponse;
-    avatar?: string | null;
-    email?: string;
-    color?: string | null;
-}
-/**
- * One rotated account entry returned by `POST /auth/refresh-all`. `authuser` is
- * the device-local slot index (0..N-1) the cookie was bound to.
- */
-export interface RefreshAllAccount {
-    authuser: number;
-    accessToken: string;
-    expiresAt: string;
-    sessionId: string;
-    user: RefreshAllAccountUser | null;
-}
-/**
- * Wire shape of `POST /auth/refresh-all`. Always 200 with a (possibly empty)
- * accounts array — 401 means "no accounts signed in on this device" and is
- * normalised to `{ accounts: [] }` at the SDK layer.
- */
-export interface RefreshAllResponse {
-    accounts: RefreshAllAccount[];
-}
-/**
- * Wire shape of `POST /auth/refresh` (single-slot refresh, optionally targeting
- * a specific `?authuser=N` slot). The server always includes the numeric slot in
- * the response.
- */
-export interface RefreshCookieResponse {
-    accessToken: string;
-    expiresAt: string;
-    authuser: number;
-}